[Akamai] - Added initial interval restrictions for api requests (elastic#15649)

Added initial interval restrictions for api requests and 
updated the default interval value, documentation accordingly.

Author: ShourieG

packages/akamai/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.28.1"
+  changes:
+    - description: Fixed time duration handling in request parameters to conform to API guidelines.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/15649
 - version: "2.28.0"
   changes:
     - description: Update Kibana constraint to support 9.0.0.

packages/akamai/data_stream/siem/_dev/test/system/test-emulator-config.yml

@@ -3,6 +3,8 @@ service: akamai-siem-emulator
 vars: ~
 data_stream:
   vars:
+    # initial_interval should get automatically capped to 12h by the agent logic.
+    initial_interval: 24h
     preserve_original_event: true
     api_host: "http://akamai-siem-emulator:9903"
     client_token: ct-f625f0b8-9c8f-44ce-8250-eaf17bc93051
@@ -12,5 +14,8 @@ data_stream:
     event_limit: 20
     enable_request_tracer: true
 assert:
-  # 24 hours at 5 minutes between events.
-  hit_count: 288 #  = 24 * 60/5
+  # 12 hours at 5 minutes between events.
+  hit_count: 144 #  = 12 * 60/5
+skip:
+  reason: "The fleet health status changes to degraded when the HTTPJSON template's value evaluation comes up empty, which leads to system test failures but does not interrupt the data flow."
+  link: https://github.com/elastic/beats/issues/45664

packages/akamai/data_stream/siem/agent/stream/httpjson.yml.hbs

@@ -18,8 +18,15 @@ request.tracer.maxbackups: 5
 request.transforms:
   - set:
       target: url.params.from
+      # On the initial request (no cursor), this calculates the start time.
+      # It takes the more recent of two values: the user-defined 'initial_interval'
+      # or the API's maximum 12-hour look-back, preventing API errors.
       value: >-
-        [[ if not (index .cursor "last_offset") ]][[ (now (parseDuration "-{{initial_interval}}")).Unix ]][[ end ]]
+        [[- if not (index .cursor "last_offset") -]]
+          [[- $initialTime := (now (parseDuration "-{{initial_interval}}")).Unix -]]
+          [[- $maxLookbackTime := (now (parseDuration "-12h")).Unix -]]
+          [[- max $maxLookbackTime $initialTime -]]
+        [[- end -]]
   - set:
       target: url.params.to
       value: >- 

packages/akamai/data_stream/siem/manifest.yml

@@ -67,8 +67,8 @@ streams:
         multi: false
         required: true
         show_user: true
-        default: 24h
-        description: Initial interval to poll for events. Default is 24 hours. Supported units for this parameter are h/m/s.
+        default: 12h
+        description: Initial interval to poll for events. Default is the maximum allowed value of 12 hours. Supported units for this parameter are h/m/s.
       - name: event_limit
         type: integer
         multi: false

packages/akamai/manifest.yml

@@ -1,6 +1,6 @@
 name: akamai
 title: Akamai
-version: "2.28.0"
+version: "2.28.1"
 description: Collect logs from Akamai with Elastic Agent.
 type: integration
 format_version: "3.0.2"